# kimai/kimai (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/kimai-kimai Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/kimai-kimai.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in kimai/kimai (Packagist): 0 in the last 7 days and 19 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52828, was published on 15 September 2026. Nothing in the last four weeks, down from 10 vulnerabilities in the four before. 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 19 - All time: 33 (2 critical, 0 exploited in the wild) ## About kimai/kimai (Packagist) Open-source time tracking and project management application written in PHP. ## Latest kimai/kimai (Packagist) vulnerabilities - [CVE-2026-52828: Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52827: Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay) (high, CVSS 4, published 15 Sep 2026) - [CVE-2026-52826: Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52825: Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52824: Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image) (critical, CVSS 4, published 15 Sep 2026) - [CVE-2026-52823: Kimai CSRF in Timesheet Stop and Restart API endpoints](https://junglewise.ai/threats/cve-2026-52823-kimai-csrf-in-timesheet-stop-and-restart-api-endpoints) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52822: Kimai improper authorization in timesheet restart and duplicate workflows](https://junglewise.ai/threats/cve-2026-52822-kimai-improper-authorization-in-timesheet-restart-and-duplicate) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52821: Kimai improper authorization in activity and project creation](https://junglewise.ai/threats/cve-2026-52821-kimai-improper-authorization-in-activity-and-project-creation) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52820: Kimai Timesheet authorization bypass in project assignment](https://junglewise.ai/threats/cve-2026-52820-kimai-timesheet-authorization-bypass-in-project-assignment) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-52819: Kimai authorization bypass in GET /api/timesheets API](https://junglewise.ai/threats/cve-2026-52819-kimai-authorization-bypass-in-get-api-timesheets-api) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-49992: Kimai CSRF in team creation endpoints](https://junglewise.ai/threats/cve-2026-49992-kimai-csrf-in-team-creation-endpoints) (medium, CVSS 4, published 11 Sep 2026) - [CVE-2026-49865: Kimai SSRF in invoice PDF rendering via Markdown image URLs](https://junglewise.ai/threats/cve-2026-49865-kimai-ssrf-in-invoice-pdf-rendering-via-markdown-image-urls) (medium, CVSS 4, published 11 Sep 2026) - [CVE-2026-80202: Kimai authorization bypass in timesheet voter](https://junglewise.ai/threats/cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter) (high, CVSS 8.8, published 26 Aug 2026) - [CVE-2026-80201: Kimai Twig invoice template sandbox escape via unblocked User methods](https://junglewise.ai/threats/cve-2026-80201-kimai-twig-invoice-template-sandbox-escape-via-unblocked-user) (low, CVSS 3.1, published 26 Aug 2026) - [CVE-2026-80200: Kimai open redirect in SAML authentication handler](https://junglewise.ai/threats/cve-2026-80200-kimai-open-redirect-in-saml-authentication-handler) (medium, CVSS 4.7, published 26 Aug 2026) - [CVE-2026-80199: Kimai TokenAuthenticator username enumeration via timing oracle](https://junglewise.ai/threats/cve-2026-80199-kimai-tokenauthenticator-username-enumeration-via-timing-oracle) (low, CVSS 3.7, published 26 Aug 2026) - [CVE-2026-80198: Kimai Twig config() function information disclosure in templates](https://junglewise.ai/threats/cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates) (high, CVSS 7.5, published 26 Aug 2026) - [CVE-2026-80197: Kimai improper authorization in favorite timesheet endpoints](https://junglewise.ai/threats/cve-2026-80197-kimai-improper-authorization-in-favorite-timesheet-endpoints) (medium, CVSS 4.3, published 26 Aug 2026) - [CVE-2026-80196: Kimai authentication bypass in password reset link](https://junglewise.ai/threats/cve-2026-80196-kimai-authentication-bypass-in-password-reset-link) (high, CVSS 7.5, published 26 Aug 2026) - [CVE-2026-44298: Kimai has an arbitrary file read in its invoice PDF renderer (admin)](https://junglewise.ai/threats/cve-2026-44298-kimai-has-an-arbitrary-file-read-in-its-invoice-pdf-renderer) (medium, CVSS 4.1, published 8 May 2026) - [CVE-2026-42267: Kimai formula injection in XLSX export via tag names](https://junglewise.ai/threats/cve-2026-42267-kimai-formula-injection-in-xlsx-export-via-tag-names) (medium, CVSS 5.7, published 8 May 2026) - [CVE-2026-41498: Kimai missing object-level authorization in Team API](https://junglewise.ai/threats/cve-2026-41498-kimai-has-missing-object-level-authorization-in-the-team-api) (low, CVSS 3.3, published 8 May 2026) - [CVE-2026-40486: Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate](https://junglewise.ai/threats/cve-2026-40486-kimai-s-user-preferences-api-allows-standard-users-to-modify) (medium, CVSS 4.3, published 15 Apr 2026) - [CVE-2026-40479: Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget](https://junglewise.ai/threats/cve-2026-40479-kimai-has-stored-xss-via-incomplete-html-attribute-escaping-in) (medium, CVSS 5.4, published 15 Apr 2026) - [CVE-2026-28685: Kimai missing authorization in API invoice endpoint](https://junglewise.ai/threats/cve-2026-28685-kimai-missing-authorization-in-api-invoice-endpoint) (medium, CVSS 6.5, published 4 Mar 2026) ## Most severe kimai/kimai (Packagist) vulnerabilities - [CVE-2023-53957: Kimai contains a SameSite cookie vulnerability](https://junglewise.ai/threats/cve-2023-53957-kimai-contains-a-samesite-cookie-vulnerability) (critical, CVSS 9.8, published 19 Dec 2025) - [CVE-2026-52824: Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image) (critical, CVSS 4, published 15 Sep 2026) - [CVE-2026-80202: Kimai authorization bypass in timesheet voter](https://junglewise.ai/threats/cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter) (high, CVSS 8.8, published 26 Aug 2026) - [CVE-2026-80196: Kimai authentication bypass in password reset link](https://junglewise.ai/threats/cve-2026-80196-kimai-authentication-bypass-in-password-reset-link) (high, CVSS 7.5, published 26 Aug 2026) - [CVE-2026-80198: Kimai Twig config() function information disclosure in templates](https://junglewise.ai/threats/cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates) (high, CVSS 7.5, published 26 Aug 2026) - [CVE-2026-52827: Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay) (high, CVSS 4, published 15 Sep 2026) - [CVE-2026-28685: Kimai missing authorization in API invoice endpoint](https://junglewise.ai/threats/cve-2026-28685-kimai-missing-authorization-in-api-invoice-endpoint) (medium, CVSS 6.5, published 4 Mar 2026) - [CVE-2019-25317: Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions](https://junglewise.ai/threats/cve-2019-25317-kimai-2-vulnerable-to-persistent-cross-site-scripting-in-the) (medium, CVSS 6.4, published 11 Feb 2026) - [CVE-2026-42267: Kimai formula injection in XLSX export via tag names](https://junglewise.ai/threats/cve-2026-42267-kimai-formula-injection-in-xlsx-export-via-tag-names) (medium, CVSS 5.7, published 8 May 2026) - [CVE-2026-40479: Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget](https://junglewise.ai/threats/cve-2026-40479-kimai-has-stored-xss-via-incomplete-html-attribute-escaping-in) (medium, CVSS 5.4, published 15 Apr 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 10 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 7 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 10 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "kimai/kimai (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/kimai-kimai, 12 November 2026.